Course Orientation

CPEN 442

• Instructor – Dr. Konstantin (Kosta) Beznosov

• www.ece.ubc.ca/~beznosov • Research interests

» usable security » security and privacy of online social networks » authentication and authorization on the Web » security and privacy for mobile devices

• Teaching Assistant • Ildar Muslukhov, Ph.D. candidate • Lina Qiiu, M.A.Sc.

Teaching staff

• Course orientation • course site • syllabus • calendar • term project • Q&A

• Introduction into computer security • Threat analysis

Outline

• From anonymous comments from 2009 students: • “This class invovles farily amount of programming. I am just

wondering for those in EE, are they capable of doing all these coding from scretch.”

• “This course definitely needed a strong programming background (which I happen to have). My peers without strong programming backgrounds had trouble with many of the assignments.”

• “It was helpful to have taken CPSC 317 (Networking) and CPSC 310 (Software Engineering) and also concurrently taking MATH 342 at the same time.”

• “I was lacking nearly all prerequisites for the course, and without my work experience with databases and web application programming I doubt I would have been able to keep up with the assignments. However, the focus of the quizzes and the projects was on problem-solving and applying new concepts, which my academic background had provided to me thoroughly.”

• “An Electrical Engineering student (as opposed to a Computer Engineering student) does not have the background information to do some of the assignments.”

What background should I have?

• A lot!

• From anonymous comments from 2013 students: • “I felt the assignments … were extremely time-consuming …” • “Coursework was too heavy - it was just more and more work

dumped onto the student.” • “Prof has extremely high expectations on students but I found

them hard to meet …” • “The course was very time-consuming, …” • “I spent more time on this course than on my capstone fourth

year project course, as a reference.” • “The assignments and quizzes are very difficult. The workload

of the course rivals the fourth year capstone 14 course(10credits).”

• “Homeworks, Quizzes and Projects were very hard …” • “… the expectations for the course were quite high …”

How Much Time Does the Course Require?

• From anonymous comments from 2009 students: • “If a student is taking a full course load during the semester, it is

quite unrealistic to have as many assignments and quizzes and expect students to start on the project early.”

• “quizzes, assignments, and term project and exam is too much …” • “Lots of assignments, projects, one of my most intense courses.” • “With quizzes, lengthy assignments, and a pretty much full flegged

project, as well as a final exam which is pass final to pass the course there was a lot of work to do.”

• “Very heavy workload, the term project was huge, and there were no weeks that did not include either a due assignment or a quiz.”

• “The assignments are all quite hard and take a lot of time, and the term project runs in parallel.”

• “In this course I spent rough 16 hours week …”

How Much Time Does the Course Require?

repeat after me

• This course is hard! • This course takes a lot of time!

7

• courses.ece.ubc.ca/cpen442: calendar, lecture slides, syllabus, office hours, deadlines,

• piazza.com: out of classroom announcements, Q&As • e-mail through piazza.com: urgent announcements • course calendar • announcements

• non-urgent: in the class & on piazza • urgent: through UBC e-mail

• office hours • in the calendar

course information flows

Bloom’s taxonomy of learning

9

Text

source: www.nltslibrary.info

• A lot of • hard work -- 15-20 hours/week • programming

• All the course material is on courses.ece.ubc.ca/cpen442

• Start early! • First assignment due September 15 • First quiz on September 13 • Project proposals due October 13

Key Points

assignment #1 review

term projects

term project types• design

• come up with a technological solution to a real security or privacy problem

• evaluate your solution • analysis

• analyze security of a real system/product/service

• fail the project if no vulnerabilities are found • implementation

• implement and extensively test security functionality or a feature/mechanism in a real system

13

security analysis projects

• authorized analysis of a • UBC system • third-party system

• unauthorized analysis of a • UBC system • third-party system

14

authorized security analysis projects1. preauthorized projects to analyze a UBC or third-

party system 1. Be the first group to “claim” the project. (send Kosta e-

mail with subject “412: claiming project #…”) 2. Meet with the system owner to scope out the project.

2. with authorization obtained by the students, analysis of a UBC or third-party system 1. get authorization from Kosta by September 28 2. get authorization from UBC IT Security by October 7 3. get authorization from the system owner by October 13 4. Meet with the system owner to scope out the project.

15

examples of good analysis projects• Security Analysis of Mobile Telephony Customer Account

Management, by Nikola Radoicic, Andrej Satara, Rudi Plesch, Nabeel Huq (2013)

• Security Analysis of the i>clicker Audience Response System, by Derek Gourlay, Yik Lam Sit, Yuan Sunarto, Tim Wang (2010)

• Analysis of Smart Card Laundry System, by Jon Lee, Niel Paul, Choon-Sean (Steven) Cheong, Dicky Bratawijaya (2009)

• Security Analysis of Vancouver's Pay-by-Phone Metered Parking, by Chris Lee, Benjamin Wai, James Wang, Leo Wong (2008)

• Security Analysis of Microsoft Notification Protocol, by Jason Poon, Oliver Zheng (2007)

16http://courses.ece.ubc.ca/412/term_project/previous_years_reports.html

Analysis of Smart Card Laundry System Jon Lee, Niel Paul, Choon-Sean Cheong, Dicky Bratawijaya

17

Security Analysis of Vancouver's Pay-by-Phone Metered Parking

Chris Lee, Benjamin Wai, James Wang, Leo Wong

18

Security Analysis of Microsoft Notification Protocol Jason Poon, Oliver Zheng

19

term project milestones

• October 13 • proposal presentations • written proposals and authorizations due

• November 10 • Introduction, Related Work, and Methodology sections of

the report • November 29

• project video clips due • December 5 (all day)

• project presentations • December 7

• final project reports due20

Questions